The expert report issued by the Federal Police on Friday (02/23) didn’t confirm that there is any document linking former President Luiz Inácio Lula da Silva to the contracts with Petrobras, let alone to any property allegedly given to Lula Institute or to him, as opposed to what the prosecution says (Criminal Proceeding no. 5063130-17.2016.4.04.7000/PR).
On the other hand, the report showed that: (i) the main examined system – MyWebDay – couldn’t be analyzed, something which goes against the information given by the Federal Attorney’s Office who said the document had been delivered along with Odebrecht’s Leniency Agreement; (ii) some of the files within the ones examined were destroyed and tampered with. Details below:
a) The Federal Experts couldn’t access the main system that is the subject matter of the expert analysis, MyWebDay, thus confirming that Lula’s defense was right in questioning the documents the Federal Attorney’s Office attributed to said system in order to accuse the former President:
Page 122 of the Report:
“We must highlight that, up to now, we haven’t been able to examine MyWebDay’s production environment (the real environment used by the users on a daily basis), according to the description in Subsection V.14 (page 300). However, the artefacts that resulted from the system’s users (reports, consultations), along with other elements such as MyWebDay B’s development environment, provide useful information to clarify some of the questions, like it shall be proved in this report.”
b) Some of the system’s data have been deliberately destroyed before the files were made available to the company responsible for guarding and elaborating the forensic copies (FRA):
Page 301 of the Report:
“The analysis of the commands history also revealed that 3 of these virtual machines had the content of their files deliberately “destroyed” through “shred” commands, whose main function is to rewrite over files with random data, destroying the content of the files, with the purpose of preventing the previous data from being read or restored by forensic tools.”
Page 302 of the Report:
“Supplementary, we could identify files with remote history connections, regarding date/time near the destruction of data event, containing records of access from IP “126.96.36.199”. The said IP is virtually linked to the telecommunications company VIVO.”
c) The experts found evidence that the files Odebrecht presented were tampered with or damaged by the company responsible for the System:
Page 68 of the Report:
“In addition, the forensic image file containing all the pieces of evidence in Disk 05 (“External HDD 1-1 (1), E01”), presented in Table 15, is intact. Which means that when the forensic image was created by Odebrecht, forensic image “DraftSystemExtUSBESXi1.E01” was already damaged.”
d) Since it was impossible to access the main system, MyWebDay, the expert analysis was harmed when it comes to answering the question made by former President Lula’s Defense, that asked the experts to clarify if the files Odebrecht presented were identical to those hosted in the original Data Center called Banhoff, in Switzerland. Such fundamental information was not confirmed in the expert report.
Said confirmation, once the federal experts identified that some files have been deliberately destroyed, was fundamental in order to know what are de differences between the original files (Banhoff) and those files that Odebrecht copied and presented.
e) The Federal Police experts also identified some files that were altered after Federal Attorney’s Office received the material from Odebrecht:
Page 82 of Report:
“Some files/folders were also found, besides the forensic image files altered/created after the day such material was received by the Federal Attorney’s Office (SPPEA/PGR), emphasis in Table 23. The fact that such files exist indicates that there has been a connection between the disks with evidence sent by Odebrecht to the Federal Attorney’s Office in a USB port without blocking the said media.”
f) The Federal Police experts compared the PDF files delivered by Odebrecht with the other documents the same Odebrecht delivered – and not to the systems, as the court ordered:
Page 70 of the Report:
“For the analysis of the integrity of the received data, Odebrecht was requested to provide a list of files with the respective hashes. As a response, we received a file containing a list of files and the corresponding hashes, generated from the files in possession of the law firm Odebrecht hired in Switzerland. Such list was compared with the files in Disk 05 to 08, and we could identify that the files in the list of hashes were stored in this disks with the same hashes, indicating that there has been no alteration to the content of these files until the moment of the examinations.”
Pages 126-127 of the Report:
“In an accounting performance of MyWebDay System in folder “\vol_vol2\Documents and Settings\” of evidence “\Disco_05-Xtract-PE2950-VHD-owni-ts-ts.vhd”, in folder “\Master\” of Disk 09 and Flash Drive 01 (Second Delivery), 32,685 fragments of financial reports were identified, all in PDF format, which belonged to MyWebDay system. Although, up to now, we could not make the MyWebDay system work, the amount of information in the available reports allowed the experts to understand something about the control over the extra accounting payments Odebrecht made to several beneficiaries.”
g) They verified that the same people who had access to Drousys also had access to Meinl Bank Antigua’s system:
“After analyzing the state created on “04/16/2016 14:44:04”, named “APÓS RECUPERAR” [after restoring] (Picture 29), the experts verified that, in the moment such state was created, the virtual machine (identifier 1.9 in Table 43) was set to the electronic mail domains: “draftsystems.net”, “drousys.com”, “vpnep.com” and “meinlbank.com.ag”, as illustrated in Picture 28.”
The finding that the material that was actually examined was tampered with, besides being recognized in the expert’s report, is confirmed by testimonies given before the judge of the 13th Federal Criminal Court of Curitiba. On the same day that the expert report was presented (02/23), for example, Fernando Migliaccio, a former member of the so-called Odebrecht Structured Transactions Department, testified and acknowledged that there was a meeting in Madrid in the second half of 2015 with the participation of the creator of one of the systems used in the parallel accounting of the group in order to discuss the “protection” of the members. The executive also admitted that it was possible to add and delete information from the Drousys system, which is used for communication of Odebrecht’s parallel accounting system.
Lula Institute has been operating in the same property since 1991. Former President Lula has not requested or received from Odebrecht or from any other company a property intended to the institution. Lula has not requested and neither received the ownership of an apartment his family rents and regularly pays such rent either.
The charges pressed by the Federal Attorney’s Office in this criminal proceeding have no probable cause that a crime has been committed and are part of the “lawfare” practiced against Lula by some public officials, which is the misuse of and abuse of the laws and legal procedures for political persecution ends.
CRISTIANO ZANIN MARTINS
VALESKA TEIXEIRA ZANIN MARTINS